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Listing of Claims 

What is claimed is: 

1 . (Currently Amended) A method of tracking incoming transmissions comprising: 
identifying an incoming transmission including at least one identifiable portion; 
computing, for each identifiable portion in the incoming transmission, a fingerprint 

indicative of the at least one identified portion, the fingerprint being substantially unique 
to the at least one identified portion; 

storing the computed fingerprint to generate a set of stored fingerprints; 

receiving a set of comparison fingerprints corresponding to a known portion of 
the incoming transmission, the set of comparison fingerprints being pr e d e t e rm i n e d; and 
predetermined; 

comparing the set of stored fingerprints to the set of comparison fingerprints to 
identify stored fingerprints matching at least one of the set of comparison fingerprints 
and, if a match is found, identifying a previous incoming transmission corresponding to 
a matching stored fingerprint of the set of stor e d f i ng e rpr i nts, stored fingerprints; 

storing an indication of a subsequent disposition of the incoming transmission; 

receiving a subsequent set of comparison fingerprints, the subsequent set of 
comparison fingerprints indicative of refinements to the known portion of the incoming 
transmission; 

matching the subsequent set of comparison fingerprints to the stored fingerprints; 

determining, based on the matching of the subsequent set of comparison 
fingerprints, if the subsequent set of comparison fingerprints is indicative of an 
undesirable portion in the incoming transmission; and 

selectively performing, based on the determining, a remedial action in response 
to the subsequent disposition. 

2. (Previously Presented) The method of claim 1 wherein storing further comprises 
selectively storing, if the incoming transmission does not correspond to the set of 
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comparison fingerprints, at least one fingerprint corresponding to the at least one 
identifiable portion of the incoming transmission. 

3. (Original) The method of claim 1 wherein computing the fingerprint value 
includes determining a signature and comparing comprises signature matching. 

4. (Original) The method of claim 1 further comprising receiving at least one 
successive set of comparison fingerprints, and iteratively comparing the successive sets 
of comparison fingerprints to the stored fingerprints, wherein if a match is found, 
identifying a distribution set of the incoming message corresponding to the matching 
stored fingerprint and transmitting an indication of the match to the distribution set. 

5. (Previously Presented) The method of claim 1 wherein the set of comparison 
fingerprints are virus signatures computed from known undesirable transactions. 

6. (Canceled) 

7. (Currently Amended) Th e m e thod of claim 6 The method of claim 1 wherein the 
subsequent disposition includes transmitting the incoming transmission to a list of 
successive recipients; and the remedial action is sending a notification to the 
successive recipients indicative of the matching incoming transmission. 

8. (Original) The method of claim 1 wherein the incoming transmission further 
comprises a series of potentially harmful network transmissions, each of the incoming 
transmission operable to include malicious code, wherein the subsequent disposition 
includes delivery to at least one successive recipient and remedial action includes 
determining the successive recipients from the stored successive disposition and 
notifying each of the successive recipients. 
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9. (Original) The method of claim 1 wherein the determined undesirable portion did 
not indicate undesirable transmissions based on the comparing of a previous set of 
comparison fingerprints. 

10. (Original) The method of claim 1 further comprising demarcating the incoming 
transmission into segments, each segment operable to yield a fingerprint, wherein 
comparing further comprises comparing each value in the set of comparison fingerprints 
with at least one of the segments. 

11. (Currently Amended) Th e m e thod of c l aim 1 The method of claim 10 further 
comprising 

identifying a segment type of each segment, the segment type corresponding to 
the content included in the segment; and 

categorizing each of the segments according to a heuristic, the heuristic 
indicative of a likelihood of the categorized segment including an undesirable 
transmission. 

12. (Original) The method of claim 11 further comprising: 
identifying a risk assessment of each of the segment types; and 

storing the segment according to the identified risk assessment, storing further 
including identifying a duration. 

13. (Original) The method of claim 12 wherein storing the segments further 
comprises storing the content of the segment with the corresponding fingerprint. 

14. (Original) The method of claim 1 wherein the undesirable portions are selected 
from the group consisting of viruses, worms and Trojan horses included as an 
attachment according to an established mail protocol. 

1 5. (Withdrawn) A method of computer virus prevention comprising: 
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maintaining a first set of undesirable content definitions, the set of undesirable 
content definitions indicative of malicious transmissions; 

comparing incoming transmissions to the first set of undesirable content 
definitions, the comparison result identifying malicious transmissions; 

computing an artifact indicative of the incoming transmission, the artifact 
operable to identify the corresponding incoming transmission and distinguishable from 
artifacts corresponding to other incoming transmissions; 

selectively storing, based on the comparison of the first set, if the incoming 
transmission does not correspond with the first set of undesirable content definitions, at 
least one artifact corresponding to the incoming transmission; 

receiving an indication of a malicious segment; 

merging the indication of the malicious segment with the first set of undesirable 
content definitions to generate a second set of undesirable content definitions; 

comparing the second set of undesirable content definitions with the artifacts 
corresponding to the stored incoming transmissions; and 

determining, based on the comparing of the second set of undesirable content 
definitions to the stored artifacts of previously processed transmissions, the incoming 
transmissions including malicious segments. 

16. (Withdrawn) The method of claim 16 wherein the incoming transmission is not 
indicated as including a malicious segment by the first set of undesirable content 
definitions and matches a successive set of undesirable content definitions. 

17. (Currently Amended) A data communications device for tracking incoming 
transmissions comprising: 

a processor comprising: 

a s e rv e r a mail server having a scanner operable to identify an incoming 
transmission including at least one identifiable portion; 
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a segmenter operable to compute for each identifiable portion in the 
incoming transmission, a fingerprint indicative of the at least one identified portion, the 
fingerprint being substantially unique to the at least one identified portion; 

a repository operable to store the computed fingerprints as a set of stored 
fingerprints, the repository, the sefvef mail server further operable to receive a set of 
comparison fingerprints corresponding to a known portion of the incoming transmission, 
the set of comparison fingerprints being pr e d e t e rm i n e d: and predetermined: 

a comparator operable to compare the set of stored fingerprints to the set 
of comparison fingerprints to identify stored fingerprints matching any of the set of 
comparison fingerprints and, if a match is found, identifying a previously processed 
incoming transmission corresponding to a matching stored fingerprint of the set of 
stored f i ng e rpr i nts- fingerprints: 

wherein the repository is operable to store an indication of a subsequent 
disposition of the incoming transmission: 

wherein the mail server is further operable to receive a subsequent set of 

comparison fingerprints, the subsequent set indicative of refinements to the known 
portion of the incoming transmission: 

wherein the comparator is further operable to match the subsequent set of 

comparison fingerprints to the stored fingerprints, and determine, based on the 
matching of the subsequent set of comparison fingerprints, if the subsequent set of 
comparison fingerprint is indicative of an undesirable portion in the incoming 
transmission: and 

wherein the mail server is further operable to selectively perform, based 

on the determining, a remedial action in response to the subsequent disposition. 

18. (Previously Presented) The data communications device of claim 1 7 wherein the 
repository further includes stored fingerprints including at least one fingerprint 
corresponding to the at least one identifiable portion of the incoming transmission. 
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19. (Original) The data communications device of claim 17 wherein the segmenter is 
further operable to compute the fingerprint value by determining a signature and the 
comparator is operable to compare fingerprints via signature matching. 

20. (Original) The data communications device of claim 17 wherein the mail server 
is in communication with a virus detection determiner and is operable to receiving at 
least one successive set of comparison fingerprints from the virus detection determiner, 
and further operable to iteratively compare the received successive set of comparison 
fingerprints to the stored fingerprints, and responsively to a match, identify a distribution 
set of the incoming message corresponding to the matching stored fingerprint and 
transmitting an indication of the match to the distribution set. 

21 . (Previously Presented) The data communications device of claim 17 wherein the 
set of comparison fingerprints are virus signatures computed from known undesirable 
transactions. 

22. (Canceled) 

23. (Currently Amended) The data communications d e v i c e of c l a i m 22 device of 
claim 17 wherein the mail server is further operable to transmitting the incoming 
transmission to a list of successive recipients, and sending a notification to the 
successive recipients indicative of the matching incoming transmission. 

24. (Original) The data communications device of claim 17 wherein the incoming 
transmission further comprises a series of potentially harmful network transmissions, 
each of the incoming transmission operable to include malicious code, wherein the 
disposition reference is operable to store an indication of delivery to at least one 
successive recipient. 
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25. (Original) The data communications device of claim 17 wherein the determined 
undesirable portion did not indicate undesirable transmissions based on the comparing 
of a previous set of comparison fingerprints. 

26. (Original) The data communications device of claim 17 wherein the segmenter is 
operable to demarcate the incoming transmission into segments, each segment 
operable to yield a fingerprint, wherein the comparator is operable to compare each 
value in the set of comparison fingerprints with at least one of the segments. 

27. (Original) The data communications device of claim 26 wherein the segmenter is 
operable to: 

identify a segment type of each segment, the segment type corresponding to the 
content included in the segment; and 

categorize each of the segments according to a heuristic, the heuristic indicative 
of a likelihood of the categorized segment including an undesirable transmission. 

28. (Original) The data communications device of claim 27 wherein the segmenter is 
further operable to identify a risk assessment of each of the segment types, and the 
stored fingerprints are operable to storing the segment according to the identified risk 
assessment, storing further including identifying a duration. 

29. (Original) The data communications device of claim 28 wherein the stored 
segments further comprises the data content of the segment with the corresponding 
fingerprint. 

30. (Currently Amended) A computer program product having a computer readable 
medium operable to store computer program logic embodied in computer program code 
encoded thereon for tracking incoming transmissions comprising: 

computer program code for identifying an incoming transmission including at 
least one identifiable portion; 
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computer program code for computing, for each identifiable portion in the 
incoming transmission, a fingerprint indicative of the at least one identified portion, the 
fingerprint being substantially unique to the at least one identified portion; 

computer program code for storing the computed fingerprint to generate a set of 
stored fingerprints; 

computer program code for receiving a set of comparison fingerprints 
corresponding to known portion of the incoming transmission, the set of comparison 
fingerprints being pr e d e t e rm i n e d; and predetermined; 

computer program code for comparing the set of stored fingerprints to the set of 
comparison fingerprints to identify stored fingerprints matching any of the set of 
comparison fingerprints and, if a match is found, identifying a previously received 
incoming transmission corresponding to a matching stored fingerprint of the set of 
stor e d f i ng e rpr i nts, stored fingerprints; 

computer program code for storing an indication of a subsequent disposition of 
the incoming transmission; 

computer program code for receiving a subsequent set of comparison 
fingerprints, the subsequent set of comparison fingerprints indicative of refinements to 
the known portion of the incoming transmission; 

computer program code for matching the subsequent set of comparison 
fingerprints to the stored fingerprints; 

computer program code for determining, based on the matching of the 
subsequent set of comparison fingerprints, if the subsequent set of comparison 
fingerprints is indicative of an undesirable portion in the incoming transmission; and 

computer program code for selectively performing, based on the determining, a 
remedial action in response to the subsequent disposition. 

31 . (Canceled) 

32. (Currently Amended) A data communications device for tracking incoming 
transmissions comprising: 
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a processor comprising: 

a means for identifying an incoming transmission including at least one 
identifiable portion; 

a means for computing, for each identifiable portion in the incoming 
transmission, a fingerprint indicative of the at least one identified portion, the 
fingerprint being substantially unique to the at least one identified portion; 
means for storing the computed fingerprint to generate a set of stored 
fingerprints; 

a means for receiving a set of comparison fingerprints corresponding to 
known portion of the incoming transmission, the set of comparison fingerprints 
being prodotorm i nod; and predetermined; 

a means for comparing the set of stored fingerprints to the set of 
comparison fingerprints to identify stored fingerprints matching any of the set of 
comparison fingerprints and, if a match is found, identifying a previously received 
incoming transmission corresponding to the matching stored fingerprint of the set 
o f stor e d f i ng e rpr i nts, stored fingerprints; 

a means for storing an indication of a subsequent disposition of the 
incoming transmission; 

a means for receiving a subsequent set of comparison fingerprints, the 
subsequent set of comparison fingerprints indicative of refinements to the known 
portion of the incoming transmission; 

a means for matching the subsequent set of comparison fingerprints to the 
stored fingerprints; 

a means for determining, based on the matching of the subsequent set of 
comparison fingerprints, if the subsequent set of comparison fingerprints is 
indicative of an undesirable portion in the incoming transmission; and 

a means for selectively performing, based on the determining, a remedial 
action in response to the subsequent disposition. 
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33. (Previously Presented) The method of claim 1, wherein the identifying a previous 
incoming transmission corresponding to a matching stored fingerprint of the set of 
stored fingerprints is a retroactive analysis of a previously accepted transmission. 

34. (Previously Presented) The data communications device of claim 17, wherein 
identifying a previously processed incoming transmission corresponding to a matching 
stored fingerprint of the set of stored fingerprints is a retroactive analysis of a previously 
accepted transmission. 



